Bypassing Cylance AI Malware Detection via Universal String
CylancePROTECT, Cylance Smart Antivirus
Researchers created a universal bypass string appended to malicious files to evade detection by Cylance's AI malware detector. This was a research exercise demonstrating vulnerability in commercial security software.
- first report
- 3 Dec 2020
- last update
- 3 Dec 2020
Timeline · 3
Sources · 3
News and write-ups
- 2020-12-03Skylight Cyber Blog Post, "Cylance, I Kill You!"skylightcyber.com · skylightcyber.com/2019/07/18/cylance-i-kill-you
- 2020-12-03Statements from Skylight Cyber CEOsecurity7.net · security7.net/news/the-new-cylance-vulnerability-what-you-need-to-know
Research and catalogues
- 2020-12-03Bypassing Cylance's AI Malware DetectionMITRE ATLAS · atlas.mitre.org/studies/AML.CS0003
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Adversarial evasion
- severity
- 1 · Research / proof of concept
- targets
- Enterprise deployment
- owasp llm top 10
- no entry for these categories
- dates
- happened 7 Sep 2019 · first reported 3 Dec 2020
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Bypassing Cylance AI Malware Detection via Universal String https://gcdradar.vercel.app/incidents/bypassing-cylance-ai-malware-detection-via-universal-string · AIR-2020-0031 · closed 2020-12-17 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2020-12-03 (happened 2019-09-07) - AI role: Attack on AI - Products: CylancePROTECT, Cylance Smart Antivirus ## Summary Researchers created a universal bypass string appended to malicious files to evade detection by Cylance's AI malware detector. This was a research exercise demonstrating vulnerability in commercial security software. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2020-12-03: Statements from Skylight Cyber CEO (https://security7.net/news/the-new-cylance-vulnerability-what-you-need-to-know) - 2020-12-03: Skylight Cyber Blog Post, "Cylance, I Kill You!" (https://skylightcyber.com/2019/07/18/cylance-i-kill-you) - 2020-12-03: Bypassing Cylance's AI Malware Detection (https://atlas.mitre.org/studies/AML.CS0003) ## Sources - 2020-12-03 MITRE ATLAS: Bypassing Cylance's AI Malware Detection https://atlas.mitre.org/studies/AML.CS0003 - 2020-12-03 skylightcyber.com: Skylight Cyber Blog Post, "Cylance, I Kill You!" https://skylightcyber.com/2019/07/18/cylance-i-kill-you - 2020-12-03 security7.net: Statements from Skylight Cyber CEO https://security7.net/news/the-new-cylance-vulnerability-what-you-need-to-know Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedDGA detector Botnet DGA Detection Evasion Using Domain Mutation
Research · since 1 Jan 2020
AI - closedPalo Alto Networks malware detection system Evasion of Deep Learning Detector for Malware C&C Traffic
Research · since 1 Jan 2020
AI - closedShanghai government tax office facial recognition Camera Hijack and Facial Recognition Evasion for Tax Fraud
Patch now · Real loss · since Jan 2020 (approx.)
AI - closedEdge AI Product Microsoft Edge AI Product Evasion Red Team Exercise
Research · since Feb 2020 (approx.)
AI - closedAzure Microsoft Internal Azure AI Service Red Team Exercise
Research · since Jan 2020 (approx.)
AI - closedCommercial Face Identification Service Face Identification System Evasion via Physical Countermeasures
Research · since 1 Jan 2020
AI